diff --git a/CHANGELOG.md b/CHANGELOG.md index b1a59fb3..d1a01bee 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,13 +11,15 @@ New release of the HyperDbg Debugger. - Added structure for the hyperperf (Hardware Performance Counter) project ([link](https://github.com/HyperDbg/HyperDbg/commit/c17ebc09c4d199a642352e66feebb3159582196c)) - The 'unload' command checks whether any module is loaded or not ([link](https://docs.hyperdbg.org/commands/debugging-commands/unload)) - Exported SDK API for checking whether any module is loaded or not ([link](https://github.com/HyperDbg/HyperDbg/commit/19e47c804f50f5dbb698f314e66b7d685a87ac1f)) +- Added user mode and kernel mode PT parameter parser ([link](https://github.com/HyperDbg/HyperDbg/pull/631)) ### Changed - Separated SDK libraries for user mode and kernel mode modules ([link](https://github.com/HyperDbg/HyperDbg/commit/c17ebc09c4d199a642352e66feebb3159582196c)) - Added hypertrace, hyperevade, and hyperperf DLL files to SDK ([link](https://github.com/HyperDbg/HyperDbg/commit/c17ebc09c4d199a642352e66feebb3159582196c)) - Fix pool manager uninitialize list corruption ([link](https://github.com/HyperDbg/HyperDbg/pull/629)) - Fix 'access denied' error on loading all modules using 'load all' ([link](https://docs.hyperdbg.org/commands/debugging-commands/load))([link](https://github.com/HyperDbg/HyperDbg/commit/2b818a5116d80d466aab7b343d4aa9d1d640f082)) -- Fix concatenation error for "hyperkd" string on the hypertrace project +- Fix the concatenation error for the "hyperkd" string on the hypertrace project (https://github.com/HyperDbg/HyperDbg/commit/2b0cc18899ff532d9d590a71bf880fee5456c15f)) +- Organized header files for the libhyperdbg project ([link](https://github.com/HyperDbg/HyperDbg/pull/632)) ## [0.20.0.0-beta] - 2026-06-21 New release of the HyperDbg Debugger. diff --git a/hyperdbg/include/SDK/headers/RequestStructures.h b/hyperdbg/include/SDK/headers/RequestStructures.h index fdf53450..5e5b66b4 100644 --- a/hyperdbg/include/SDK/headers/RequestStructures.h +++ b/hyperdbg/include/SDK/headers/RequestStructures.h @@ -1369,6 +1369,12 @@ typedef enum _HYPERTRACE_PT_OPERATION_REQUEST_TYPE */ #define PT_DEFAULT_BUFFER_SIZE 0x200000 // 2 MB +/** + * @brief The default core for PT + * + */ +#define PT_DEFAULT_PINNING_CORE 0x0 // 0th core + /** * @brief PT enable options structure * @@ -1433,6 +1439,7 @@ typedef struct _HYPERTRACE_PT_OPERATION_PACKETS // UINT64 BufferSize; /* Output buffer size (0 = default / PT_DEFAULT_BUFFER_SIZE) */ PT_ENABLE_OPTIONS EnableOptions; /* Options for enabling PT (CPL, CR3, PID, TID, Pname) */ + UINT32 CoreId; /* Core ID for running (pinning) process/thread */ // // Filter diff --git a/hyperdbg/libhyperdbg/code/debugger/commands/extension-commands/pt.cpp b/hyperdbg/libhyperdbg/code/debugger/commands/extension-commands/pt.cpp index b188c6ee..6d2a88d8 100644 --- a/hyperdbg/libhyperdbg/code/debugger/commands/extension-commands/pt.cpp +++ b/hyperdbg/libhyperdbg/code/debugger/commands/extension-commands/pt.cpp @@ -1,6 +1,7 @@ /** * @file pt.cpp * @author Masoud Rahimi Jafari (Masoodrahimy1379@gmail.com) + * @author Sina Karvandi (sina@hyperdbg.org) * @brief !pt command * @details * @version 0.19 @@ -17,6 +18,8 @@ extern BOOLEAN g_IsHyperTraceModuleLoaded; extern BOOLEAN g_IsSerialConnectedToRemoteDebuggee; + + /** * @brief help of the !pt command * @@ -29,9 +32,10 @@ CommandPtHelp() ShowMessages("syntax : \t!pt enable\n"); ShowMessages("syntax : \t!pt enable [size BufferSize (hex)]\n"); - ShowMessages("syntax : \t!pt enable [pid ProcessId (hex)] [size BufferSize (hex)]\n"); - ShowMessages("syntax : \t!pt enable [tid ThreadId (hex)] [size BufferSize (hex)]\n"); - ShowMessages("syntax : \t!pt enable [pname ProcessName (string)] [size BufferSize (hex)]\n"); + ShowMessages("syntax : \t!pt enable [pid ProcessId (hex)] [size BufferSize (hex)] [core CoreId (hex)]\n"); + ShowMessages("syntax : \t!pt enable [tid ThreadId (hex)] [size BufferSize (hex)] [core CoreId (hex)]\n"); + ShowMessages("syntax : \t!pt enable [pname ProcessName (string)] [size BufferSize (hex)] [core CoreId (hex)]\n"); + ShowMessages("syntax : \t!pt enable [path Path (string)] [size BufferSize (hex)] [core CoreId (hex)]\n"); ShowMessages("syntax : \t!pt enable [cr3 Cr3Value (hex)] [size BufferSize (hex)]\n"); ShowMessages("syntax : \t!pt disable\n"); ShowMessages("syntax : \t!pt pause\n"); @@ -51,9 +55,10 @@ CommandPtHelp() ShowMessages("\t\te.g : !pt enable size 0x200000\n"); ShowMessages("\t\te.g : !pt enable pid 0x4a8\n"); ShowMessages("\t\te.g : !pt enable pname notepad.exe\n"); - ShowMessages("\t\te.g : !pt enable tid 0x1234\n"); + ShowMessages("\t\te.g : !pt enable tid 0x1234 core 3\n"); ShowMessages("\t\te.g : !pt enable cr3 0x1aabb000\n"); ShowMessages("\t\te.g : !pt enable pid 0x4a8 size 0x200000\n"); + ShowMessages("\t\te.g : !pt enable path \"c:\\programs\\my exe file.exe\" size 0x200000 core 3\n"); ShowMessages("\t\te.g : !pt disable\n"); ShowMessages("\t\te.g : !pt pause\n"); ShowMessages("\t\te.g : !pt resume\n"); @@ -154,6 +159,745 @@ HyperDbgPerformPtOperation(HYPERTRACE_PT_OPERATION_PACKETS * PtRequest) return CommandPtSendRequest(PtRequest); } +/** + * @brief Send pt enable command + * + * @return BOOLEAN + */ +static BOOLEAN +CommandPtSendEnable() +{ + HYPERTRACE_PT_OPERATION_PACKETS PtRequest = {}; + + // + // Set the PtRequest structure for the operation + // + PtRequest.PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_ENABLE; + + // + // Send the request to perform the operation + // + if (!HyperDbgPerformPtOperation(&PtRequest)) + { + return FALSE; + } + else + { + return TRUE; + } +} + +/** + * @brief Send pt disable command + * + * @return BOOLEAN + */ +static BOOLEAN +CommandPtSendDisable() +{ + HYPERTRACE_PT_OPERATION_PACKETS PtRequest = {}; + + // + // Set the PtRequest structure for the operation + // + PtRequest.PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_DISABLE; + + // + // Send the request to perform the operation + // + if (!HyperDbgPerformPtOperation(&PtRequest)) + { + return FALSE; + } + else + { + return TRUE; + } +} + +/** + * @brief Send pt pause command + * + * @return BOOLEAN + */ +static BOOLEAN +CommandPtSendPause() +{ + HYPERTRACE_PT_OPERATION_PACKETS PtRequest = {}; + + // + // Set the PtRequest structure for the operation + // + PtRequest.PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_PAUSE; + + // + // Send the request to perform the operation + // + if (!HyperDbgPerformPtOperation(&PtRequest)) + { + return FALSE; + } + else + { + return TRUE; + } +} + +/** + * @brief Send pt resume command + * + * @return BOOLEAN + */ +static BOOLEAN +CommandPtSendResume() +{ + HYPERTRACE_PT_OPERATION_PACKETS PtRequest = {}; + + // + // Set the PtRequest structure for the operation + // + PtRequest.PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_RESUME; + + // + // Send the request to perform the operation + // + if (!HyperDbgPerformPtOperation(&PtRequest)) + { + return FALSE; + } + else + { + return TRUE; + } +} + +/** + * @brief Send pt flush command + * + * @return BOOLEAN + */ +static BOOLEAN +CommandPtSendFlush() +{ + HYPERTRACE_PT_OPERATION_PACKETS PtRequest = {}; + + // + // Set the PtRequest structure for the operation + // + PtRequest.PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_FLUSH; + + // + // Send the request to perform the operation + // + if (!HyperDbgPerformPtOperation(&PtRequest)) + { + return FALSE; + } + else + { + return TRUE; + } +} + +/** + * @brief Send pt filter command + * + * @return BOOLEAN + */ +static BOOLEAN +CommandPtSendFilterByPid(UINT32 ProcessId, + BOOLEAN IsUserMode, + BOOLEAN IsKernelMode, + UINT64 StartRange1, + UINT64 EndRange1, + UINT64 StartRange2, + UINT64 EndRange2, + UINT64 StartRange3, + UINT64 EndRange3, + UINT64 StartRange4, + UINT64 EndRange4) +{ + HYPERTRACE_PT_OPERATION_PACKETS Op = {}; + UINT8 NumberOfRanges = 0; + + // + // Set the Op structure for the operation + // + Op.PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_FILTER; + + // + // Set execution modes + // + Op.FilterOptions.TraceUser = IsUserMode ? 1 : 0; + Op.FilterOptions.TraceKernel = IsKernelMode ? 1 : 0; + + // + // Set the process ID + // + Op.EnableOptions.Pid = ProcessId; + + // + // Set the first range if provided + // + if (StartRange1 != NULL && EndRange1 != NULL) + { + Op.FilterOptions.AddrRanges[NumberOfRanges].Start = StartRange1; + Op.FilterOptions.AddrRanges[NumberOfRanges].End = EndRange1; + NumberOfRanges++; + } + + // + // Set the second range if provided + // + if (StartRange2 != NULL && EndRange2 != NULL) + { + Op.FilterOptions.AddrRanges[NumberOfRanges].Start = StartRange2; + Op.FilterOptions.AddrRanges[NumberOfRanges].End = EndRange2; + NumberOfRanges++; + } + + // + // Set the third range if provided + // + if (StartRange3 != NULL && EndRange3 != NULL) + { + Op.FilterOptions.AddrRanges[NumberOfRanges].Start = StartRange3; + Op.FilterOptions.AddrRanges[NumberOfRanges].End = EndRange3; + NumberOfRanges++; + } + + // + // Set the fourth range if provided + // + if (StartRange4 != NULL && EndRange4 != NULL) + { + Op.FilterOptions.AddrRanges[NumberOfRanges].Start = StartRange4; + Op.FilterOptions.AddrRanges[NumberOfRanges].End = EndRange4; + NumberOfRanges++; + } + + // + // Set number of ranges + // + Op.FilterOptions.NumAddrRanges = NumberOfRanges; + + // + // Send the request to perform the operation + // + if (!HyperDbgPerformPtOperation(&Op)) + { + return FALSE; + } + else + { + ShowMessages("[+] PT Filter: cr3=0x%llx, pid=0x%x, user=%x, kernel=%x, ranges=%x\n", + Op.EnableOptions.Cr3, + Op.EnableOptions.Pid, + Op.FilterOptions.TraceUser, + Op.FilterOptions.TraceKernel, + Op.FilterOptions.NumAddrRanges); + + return TRUE; + } + + return TRUE; +} + +static int +CommandPtReadImage(UINT8 * Buffer, SIZE_T Size, const struct pt_asid * Asid, UINT64 Ip, VOID * Context) +{ + (VOID) Asid; + + IMAGE_SYMBOL_CONTEXT * Ctx = (IMAGE_SYMBOL_CONTEXT *)Context; + + if (Ctx == NULL || Ctx->Code == NULL || Ip < Ctx->CodeBase || Ip >= Ctx->CodeBase + Ctx->CodeSize) + return -pte_nomap; + + UINT64 Available = Ctx->CodeBase + Ctx->CodeSize - Ip; + SIZE_T Count = (Size < Available) ? Size : (SIZE_T)Available; + + memcpy(Buffer, Ctx->Code + (Ip - Ctx->CodeBase), Count); + return (int)Count; +} + +typedef struct _PROC_BASIC_INFO +{ + LONG ExitStatus; + PVOID PebBaseAddress; + ULONG_PTR Reserved[4]; +} PROC_BASIC_INFO; + +typedef LONG(NTAPI * PFN_NT_QIP)(HANDLE, ULONG, PVOID, ULONG, PULONG); + +static BOOLEAN +CommandPtCaptureImage(HANDLE Process, UINT64 * TextStart, UINT64 * TextEnd, IMAGE_SYMBOL_CONTEXT * Ctx) +{ + HMODULE Ntdll = GetModuleHandleA("ntdll.dll"); + PFN_NT_QIP NtQip = Ntdll ? (PFN_NT_QIP)GetProcAddress(Ntdll, "NtQueryInformationProcess") : NULL; + PROC_BASIC_INFO Pbi = {0}; + ULONG Ret = 0; + SIZE_T Got = 0; + UINT64 Base = 0; + IMAGE_DOS_HEADER Dos; + IMAGE_NT_HEADERS64 Nt; + UINT64 SectionBase; + + if (NtQip == NULL || NtQip(Process, 0, &Pbi, sizeof(Pbi), &Ret) < 0 || Pbi.PebBaseAddress == NULL) + return FALSE; + + if (!ReadProcessMemory(Process, (PBYTE)Pbi.PebBaseAddress + 0x10, &Base, sizeof(Base), &Got) || Base == 0) + return FALSE; + + if (!ReadProcessMemory(Process, (PVOID)Base, &Dos, sizeof(Dos), &Got) || Dos.e_magic != IMAGE_DOS_SIGNATURE) + return FALSE; + + if (!ReadProcessMemory(Process, (PBYTE)Base + Dos.e_lfanew, &Nt, sizeof(Nt), &Got) || Nt.Signature != IMAGE_NT_SIGNATURE) + return FALSE; + + Ctx->ImageBase = Base; + SectionBase = Base + Dos.e_lfanew + FIELD_OFFSET(IMAGE_NT_HEADERS64, OptionalHeader) + Nt.FileHeader.SizeOfOptionalHeader; + + for (WORD i = 0; i < Nt.FileHeader.NumberOfSections; i++) + { + IMAGE_SECTION_HEADER Section; + + if (!ReadProcessMemory(Process, (PBYTE)SectionBase + (UINT64)i * sizeof(Section), &Section, sizeof(Section), &Got)) + return FALSE; + + if (memcmp(Section.Name, ".text", 6) != 0) + continue; + + UINT64 Start = Base + Section.VirtualAddress; + UINT64 Size = Section.Misc.VirtualSize ? Section.Misc.VirtualSize : Section.SizeOfRawData; + + if (Size == 0) + return FALSE; + + Ctx->Code = (UINT8 *)malloc((SIZE_T)Size); + if (Ctx->Code == NULL) + return FALSE; + + if (!ReadProcessMemory(Process, (PVOID)Start, Ctx->Code, (SIZE_T)Size, &Got) || Got != Size) + { + free(Ctx->Code); + Ctx->Code = NULL; + return FALSE; + } + + Ctx->CodeBase = Start; + Ctx->CodeSize = Size; + *TextStart = Start; + *TextEnd = Start + Size - 1; + return TRUE; + } + + return FALSE; +} + +static BOOLEAN +CommandPtResolveFunction(HANDLE Process, const CHAR * Path, const CHAR * Name, UINT64 ImageBase, UINT64 * Start, UINT64 * End) +{ + union + { + SYMBOL_INFO Info; + BYTE Buffer[sizeof(SYMBOL_INFO) + MAX_SYM_NAME]; + } Symbol = {0}; + BOOLEAN Ok = FALSE; + + SymSetOptions(SYMOPT_UNDNAME | SYMOPT_DEFERRED_LOADS); + if (!SymInitialize(Process, NULL, FALSE)) + return FALSE; + + if (SymLoadModuleEx(Process, NULL, Path, NULL, (DWORD64)ImageBase, 0, NULL, 0) != 0) + { + Symbol.Info.SizeOfStruct = sizeof(SYMBOL_INFO); + Symbol.Info.MaxNameLen = MAX_SYM_NAME; + + if (SymFromName(Process, Name, &Symbol.Info) && Symbol.Info.Address != 0) + { + *Start = Symbol.Info.Address; + *End = Symbol.Info.Address + (Symbol.Info.Size ? Symbol.Info.Size : 0x200) - 1; + Ok = TRUE; + } + } + + SymCleanup(Process); + return Ok; +} + +static const CHAR * +CommandPtPacketName(enum pt_packet_type Type) +{ + switch (Type) + { + case ppt_psb: + return "PSB"; + case ppt_psbend: + return "PSBEND"; + case ppt_pad: + return "PAD"; + case ppt_fup: + return "FUP"; + case ppt_tip: + return "TIP"; + case ppt_tip_pge: + return "TIP.PGE"; + case ppt_tip_pgd: + return "TIP.PGD"; + case ppt_tnt_8: + return "TNT8"; + case ppt_tnt_64: + return "TNT64"; + case ppt_mode: + return "MODE"; + case ppt_pip: + return "PIP"; + case ppt_vmcs: + return "VMCS"; + case ppt_cbr: + return "CBR"; + case ppt_tsc: + return "TSC"; + case ppt_tma: + return "TMA"; + case ppt_mtc: + return "MTC"; + case ppt_cyc: + return "CYC"; + case ppt_ovf: + return "OVF"; + case ppt_stop: + return "STOP"; + case ppt_exstop: + return "EXSTOP"; + case ppt_mnt: + return "MNT"; + case ppt_ptw: + return "PTW"; + default: + return "?"; + } +} + +static UINT64 +CommandPtReconstructIp(const struct pt_packet_ip * Packet, UINT64 * LastIp) +{ + UINT64 Value = *LastIp; + + switch (Packet->ipc) + { + case pt_ipc_update_16: + Value = (Value & ~0xffffull) | (Packet->ip & 0xffffull); + break; + case pt_ipc_update_32: + Value = (Value & ~0xffffffffull) | (Packet->ip & 0xffffffffull); + break; + case pt_ipc_update_48: + Value = (Value & ~0xffffffffffffull) | (Packet->ip & 0xffffffffffffull); + break; + case pt_ipc_sext_48: + Value = Packet->ip & 0xffffffffffffull; + if (Value & 0x800000000000ull) + Value |= 0xffff000000000000ull; + break; + default: + Value = Packet->ip; + break; + } + + *LastIp = Value; + return Value; +} + +static UINT64 +CommandPtDecodeCorePackets(UINT32 Cpu, const UINT8 * Buffer, UINT64 Size, UINT64 ImageBase) +{ + struct pt_config Config; + struct pt_packet_decoder * Decoder; + UINT64 Count = 0; + UINT64 LastIp = 0; + int Status; + + pt_config_init(&Config); + Config.begin = (UINT8 *)Buffer; + Config.end = (UINT8 *)Buffer + Size; + + Decoder = pt_pkt_alloc_decoder(&Config); + if (Decoder == NULL) + { + ShowMessages("[-] core %u: cannot allocate packet decoder\n", Cpu); + return 0; + } + + for (;;) + { + Status = pt_pkt_sync_forward(Decoder); + if (Status < 0) + break; + + for (;;) + { + struct pt_packet Packet; + + Status = pt_pkt_next(Decoder, &Packet, sizeof(Packet)); + if (Status < 0) + break; + + Count++; + + switch (Packet.type) + { + case ppt_tnt_8: + case ppt_tnt_64: + ShowMessages(" %-8s %2u ", CommandPtPacketName(Packet.type), Packet.payload.tnt.bit_size); + for (UINT8 Bit = 0; Bit < Packet.payload.tnt.bit_size && Bit < 64; Bit++) + putchar(((Packet.payload.tnt.payload >> (Packet.payload.tnt.bit_size - 1 - Bit)) & 1) ? 'T' : 'N'); + putchar('\n'); + break; + + case ppt_tip: + case ppt_fup: + case ppt_tip_pge: + case ppt_tip_pgd: + if (Packet.payload.ip.ipc == pt_ipc_suppressed) + ShowMessages(" %-8s (ip suppressed)\n", CommandPtPacketName(Packet.type)); + else + { + UINT64 Ip = CommandPtReconstructIp(&Packet.payload.ip, &LastIp); + ShowMessages(" %-8s 0x%016llx exe+0x%llx\n", + CommandPtPacketName(Packet.type), + (UINT64)Ip, + (UINT64)(Ip - ImageBase)); + } + break; + + case ppt_pip: + ShowMessages(" %-8s cr3=0x%llx\n", CommandPtPacketName(Packet.type), (UINT64)Packet.payload.pip.cr3); + break; + + case ppt_cbr: + // ShowMessages(" %-8s ratio=%u\n", CommandPtPacketName(Packet.type), Packet.payload.cbr.ratio); + break; + + case ppt_tsc: + ShowMessages(" %-8s tsc=0x%llx\n", CommandPtPacketName(Packet.type), (UINT64)Packet.payload.tsc.tsc); + break; + + default: + // ShowMessages(" %-8s\n", CommandPtPacketName(Packet.type)); + break; + } + } + } + + pt_pkt_free_decoder(Decoder); + return Count; +} + +static UINT64 +CommandPtDecodeCore(UINT32 Cpu, const UINT8 * Buffer, UINT64 Size, IMAGE_SYMBOL_CONTEXT * Ctx) +{ + struct pt_config Config; + struct pt_insn_decoder * Decoder; + struct pt_image * Image; + UINT64 Count = 0; + int Status; + + pt_config_init(&Config); + Config.begin = (UINT8 *)Buffer; + Config.end = (UINT8 *)Buffer + Size; + + Decoder = pt_insn_alloc_decoder(&Config); + if (Decoder == NULL) + { + ShowMessages("[-] core %u: cannot allocate instruction decoder\n", Cpu); + return 0; + } + + Image = pt_insn_get_image(Decoder); + pt_image_set_callback(Image, CommandPtReadImage, Ctx); + + for (;;) + { + Status = pt_insn_sync_forward(Decoder); + if (Status < 0) + break; + + for (;;) + { + struct pt_insn Insn; + + while (Status & pts_event_pending) + { + struct pt_event Event; + Status = pt_insn_event(Decoder, &Event, sizeof(Event)); + if (Status < 0) + break; + } + + if (Status < 0 || (Status & pts_eos)) + break; + + Status = pt_insn_next(Decoder, &Insn, sizeof(Insn)); + if (Status < 0) + break; + + ZydisDisassembledInstruction Disasm; + ZydisMachineMode Mode = (Insn.mode == ptem_32bit) ? ZYDIS_MACHINE_MODE_LEGACY_32 : ZYDIS_MACHINE_MODE_LONG_64; + + if (ZYAN_SUCCESS(ZydisDisassembleIntel(Mode, Insn.ip, Insn.raw, Insn.size, &Disasm))) + ShowMessages(" 0x%016llx exe+0x%-6llx %s\n", + (UINT64)Insn.ip, + (UINT64)(Insn.ip - Ctx->ImageBase), + Disasm.text); + else + ShowMessages(" 0x%016llx (undecodable)\n", (UINT64)Insn.ip); + + Count++; + } + + if (Status >= 0 && (Status & pts_eos)) + break; + } + + pt_insn_free_decoder(Decoder); + return Count; +} + +static VOID +CommandPtRunAndTrace(const CHAR * Path, const CHAR * Function, BOOLEAN Packets, int PinCore) +{ + STARTUPINFOA Startup = {}; + PROCESS_INFORMATION Process = {}; + HYPERTRACE_PT_MMAP_PACKETS Mmap = {}; + HYPERTRACE_PT_OPERATION_PACKETS Sizes = {}; + IMAGE_SYMBOL_CONTEXT Ctx = {}; + UINT64 TextStart = 0; + UINT64 TextEnd = 0; + UINT64 FilterStart = 0; + UINT64 FilterEnd = 0; + UINT64 Total = 0; + + Startup.cb = sizeof(Startup); + + if (!CreateProcessA(Path, NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &Startup, &Process)) + { + ShowMessages("[-] cannot launch '%s' (error 0x%x)\n", Path, GetLastError()); + return; + } + + ShowMessages("[+] launched '%s' (pid %u, suspended)\n", Path, Process.dwProcessId); + + if (PinCore >= 0) + { + DWORD_PTR Mask = (DWORD_PTR)1 << PinCore; + if (SetProcessAffinityMask(Process.hProcess, Mask)) + ShowMessages("[+] pinned target to core %d (all trace should land on this core)\n", PinCore); + else + ShowMessages("[!] could not pin to core %d (error 0x%x); running unpinned\n", PinCore, GetLastError()); + } + else + { + ShowMessages("[*] target unpinned (scheduler may migrate it across cores)\n"); + } + + if (!CommandPtCaptureImage(Process.hProcess, &TextStart, &TextEnd, &Ctx)) + { + ShowMessages("[-] cannot read target image / .text section\n"); + TerminateProcess(Process.hProcess, 1); + goto Cleanup; + } + + ShowMessages("[+] image base 0x%llx, .text 0x%llx-0x%llx (%llu bytes)\n", + (UINT64)Ctx.ImageBase, + (UINT64)TextStart, + (UINT64)TextEnd, + (UINT64)Ctx.CodeSize); + + FilterStart = TextStart; + FilterEnd = TextEnd; + + if (Function != NULL && CommandPtResolveFunction(Process.hProcess, Path, Function, Ctx.ImageBase, &FilterStart, &FilterEnd)) + { + ShowMessages("[+] IP filter narrowed to '%s' 0x%llx-0x%llx (%llu bytes)\n", + Function, + (UINT64)FilterStart, + (UINT64)FilterEnd, + (UINT64)(FilterEnd - FilterStart + 1)); + } + else + { + ShowMessages("[!] IP filter: whole .text (symbol '%s' not found - build the target with a PDB)\n", + Function ? Function : "(none)"); + } + + if (!CommandPtSendFilterByPid(Process.dwProcessId, TRUE, FALSE, FilterStart, FilterEnd, NULL, NULL, NULL, NULL, NULL, NULL) || + !CommandPtSendEnable()) + { + ShowMessages("[-] cannot enable Intel PT\n"); + TerminateProcess(Process.hProcess, 1); + goto Cleanup; + } + + if (!hyperdbg_u_pt_mmap(&Mmap)) + { + ShowMessages("[-] pt_mmap failed\n"); + CommandPtSendDisable(); + TerminateProcess(Process.hProcess, 1); + goto Cleanup; + } + + ShowMessages("[+] PT enabled, %u per-core buffers mapped\n", Mmap.NumCpus); + ShowMessages("[*] resuming target and waiting for it to exit...\n"); + + ResumeThread(Process.hThread); + WaitForSingleObject(Process.hProcess, INFINITE); + ShowMessages("[+] target exited, decoding trace\n"); + + CommandPtSendPause(); + + Sizes.PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_SIZE; + if (!hyperdbg_u_pt_operation(&Sizes)) + { + ShowMessages("[-] cannot query PT sizes\n"); + CommandPtSendDisable(); + + goto Cleanup; + } + + for (UINT32 i = 0; i < Mmap.NumCpus; i++) + { + UINT32 Cpu = Mmap.Cpus[i].CpuId; + UINT64 Bytes = (Cpu < Sizes.NumCpus) ? Sizes.BytesPerCpu[Cpu] : 0; + + if (Bytes == 0) + continue; + + if (Bytes > Mmap.Cpus[i].Size) + Bytes = Mmap.Cpus[i].Size; + + ShowMessages("\n[*] core %u: %llu bytes of trace\n", Cpu, (UINT64)Bytes); + Total += Packets + ? CommandPtDecodeCorePackets(Cpu, (const UINT8 *)(ULONG_PTR)Mmap.Cpus[i].UserVa, Bytes, Ctx.ImageBase) + : CommandPtDecodeCore(Cpu, (const UINT8 *)(ULONG_PTR)Mmap.Cpus[i].UserVa, Bytes, &Ctx); + } + + ShowMessages("\n[+] decoded %llu %s total\n", (UINT64)Total, Packets ? "packet(s)" : "instruction(s)"); + + CommandPtSendDisable(); + +Cleanup: + if (Ctx.Code != NULL) + { + free(Ctx.Code); + Ctx.Code = NULL; + } + if (Process.hThread != NULL) + CloseHandle(Process.hThread); + if (Process.hProcess != NULL) + CloseHandle(Process.hProcess); +} + /** * @brief Map the per-CPU PT output buffers into the current process * @@ -203,82 +947,6 @@ HyperDbgPtMmapSendRequest(HYPERTRACE_PT_MMAP_PACKETS * MmapRequest) return MmapRequest->KernelStatus == DEBUGGER_OPERATION_WAS_SUCCESSFUL; } -/** - * @brief Parse options for pt disable command - * - * @param CommandTokens The command tokens to parse - * @param PtRequest The PT request structure to fill with parsed options - * - * @return VOID - */ -static VOID -CommandPtParseDisable(vector & CommandTokens, HYPERTRACE_PT_OPERATION_PACKETS * PtRequest) -{ - ShowMessages("PT disable requested\n"); - - // - // Set the PtRequest structure for disable operation - // - PtRequest->PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_DISABLE; -} - -/** - * @brief Parse options for pt disable command - * - * @param CommandTokens The command tokens to parse - * @param PtRequest The PT request structure to fill with parsed options - * - * @return VOID - */ -static VOID -CommandPtParsePause(vector & CommandTokens, HYPERTRACE_PT_OPERATION_PACKETS * PtRequest) -{ - ShowMessages("PT pause requested\n"); - - // - // Set the PtRequest structure for pause operation - // - PtRequest->PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_PAUSE; -} - -/** - * @brief Parse options for pt disable command - * - * @param CommandTokens The command tokens to parse - * @param PtRequest The PT request structure to fill with parsed options - * - * @return VOID - */ -static VOID -CommandPtParseResume(vector & CommandTokens, HYPERTRACE_PT_OPERATION_PACKETS * PtRequest) -{ - ShowMessages("PT resume requested\n"); - - // - // Set the PtRequest structure for resume operation - // - PtRequest->PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_RESUME; -} - -/** - * @brief Parse options for pt disable command - * - * @param CommandTokens The command tokens to parse - * @param PtRequest The PT request structure to fill with parsed options - * - * @return VOID - */ -static VOID -CommandPtParseFlush(vector & CommandTokens, HYPERTRACE_PT_OPERATION_PACKETS * PtRequest) -{ - ShowMessages("PT flush requested\n"); - - // - // Set the PtRequest structure for flush operation - // - PtRequest->PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_FLUSH; -} - /** * @brief Parse and display enable options for !pt enable command * @@ -292,16 +960,20 @@ CommandPtParseEnable(vector & CommandTokens, HYPERTRACE_PT_OPERATI { BOOLEAN HasPid = FALSE; BOOLEAN HasPname = FALSE; + BOOLEAN HasPath = FALSE; BOOLEAN HasTid = FALSE; BOOLEAN HasCr3 = FALSE; BOOLEAN HasSize = FALSE; + BOOLEAN HasCore = FALSE; UINT64 Pid = 0; UINT64 Tid = 0; UINT64 Cr3 = 0; UINT64 Size = 0; + UINT32 Core = 0; string Pname; + string Path; - for (size_t i = 2; i < CommandTokens.size(); i++) + for (SIZE_T i = 2; i < CommandTokens.size(); i++) { if (CompareLowerCaseStrings(CommandTokens.at(i), "pid")) { @@ -333,6 +1005,18 @@ CommandPtParseEnable(vector & CommandTokens, HYPERTRACE_PT_OPERATI Pname = GetCaseSensitiveStringFromCommandToken(CommandTokens.at(i)); HasPname = TRUE; } + else if (CompareLowerCaseStrings(CommandTokens.at(i), "path")) + { + if (i + 1 >= CommandTokens.size()) + { + ShowMessages("err, 'path' expects a process executable path\n\n"); + CommandPtHelp(); + return; + } + i++; + Path = GetCaseSensitiveStringFromCommandToken(CommandTokens.at(i)); + HasPath = TRUE; + } else if (CompareLowerCaseStrings(CommandTokens.at(i), "tid")) { if (i + 1 >= CommandTokens.size()) @@ -387,6 +1071,24 @@ CommandPtParseEnable(vector & CommandTokens, HYPERTRACE_PT_OPERATI } HasSize = TRUE; } + else if (CompareLowerCaseStrings(CommandTokens.at(i), "core")) + { + if (i + 1 >= CommandTokens.size()) + { + ShowMessages("err, 'core' expects a hex value as the core number\n\n"); + CommandPtHelp(); + return; + } + i++; + if (!ConvertTokenToUInt32(CommandTokens.at(i), &Core)) + { + ShowMessages("err, '%s' is not a valid hex size\n\n", + GetCaseSensitiveStringFromCommandToken(CommandTokens.at(i)).c_str()); + CommandPtHelp(); + return; + } + HasCore = TRUE; + } else { ShowMessages("err, unknown 'enable' option '%s'\n\n", @@ -399,10 +1101,10 @@ CommandPtParseEnable(vector & CommandTokens, HYPERTRACE_PT_OPERATI // // pid, pname, tid, cr3 are mutually exclusive target selectors // - INT32 SelectorCount = (HasPid ? 1 : 0) + (HasPname ? 1 : 0) + (HasTid ? 1 : 0) + (HasCr3 ? 1 : 0); + INT32 SelectorCount = (HasPid ? 1 : 0) + (HasPname ? 1 : 0) + (HasPath ? 1 : 0) + (HasTid ? 1 : 0) + (HasCr3 ? 1 : 0); if (SelectorCount > 1) { - ShowMessages("err, only one of 'pid', 'pname', 'tid', 'cr3' may be specified at a time\n\n"); + ShowMessages("err, only one of 'pid', 'pname', 'path', 'tid', 'cr3' may be specified at a time\n\n"); CommandPtHelp(); return; } @@ -426,6 +1128,12 @@ CommandPtParseEnable(vector & CommandTokens, HYPERTRACE_PT_OPERATI PtRequest->EnableOptions.EnableByCr3 = 1; strcpy_s(PtRequest->EnableOptions.ProcessName, sizeof(PtRequest->EnableOptions.ProcessName), Pname.c_str()); } + else if (HasPath) + { + ShowMessages(" target path : %s\n", Path.c_str()); + + PtRequest->EnableOptions.EnableByPid = 1; // Path is resolved to a PID + } else if (HasTid) { ShowMessages(" target tid : 0x%llx\n", Tid); @@ -445,6 +1153,9 @@ CommandPtParseEnable(vector & CommandTokens, HYPERTRACE_PT_OPERATI ShowMessages(" target : all (no process/thread filter)\n"); } + // + // Check for size options + // if (HasSize) { ShowMessages(" buffer size : 0x%llx bytes\n", Size); @@ -458,10 +1169,34 @@ CommandPtParseEnable(vector & CommandTokens, HYPERTRACE_PT_OPERATI PtRequest->BufferSize = PT_DEFAULT_BUFFER_SIZE; } + // + // Check for core options + // + if (HasCore) + { + ShowMessages(" core : 0x%x\n", Core); + PtRequest->CoreId = Core; + } + else + { + ShowMessages(" core : default (0x%x)\n", PT_DEFAULT_PINNING_CORE); + PtRequest->CoreId = PT_DEFAULT_PINNING_CORE; + } + // // Fill the PtRequest structure with parsed options // PtRequest->PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_ENABLE; + + // + // Temporary workaround for testing , if a path is specified, resolve it to a PID and use that for the request + // TODO: Should be removed + // + if (HasPath) + { + ShowMessages(" Running '%s' on core: %llx\n", Path.c_str(), PtRequest->CoreId); + CommandPtRunAndTrace(Path.c_str(), NULL, FALSE, PtRequest->CoreId); + } } /** @@ -569,7 +1304,7 @@ CommandPtParseFilter(vector & CommandTokens, HYPERTRACE_PT_OPERATI BOOLEAN TraceUser = FALSE; BOOLEAN TraceKernel = FALSE; - for (size_t i = 2; i < CommandTokens.size(); i++) + for (SIZE_T i = 2; i < CommandTokens.size(); i++) { if (CompareLowerCaseStrings(CommandTokens.at(i), "user")) { @@ -791,7 +1526,7 @@ CommandPtParsePacket(vector & CommandTokens, HYPERTRACE_PT_OPERATI BOOLEAN PktFup = FALSE; BOOLEAN PktMode = FALSE; - for (size_t i = 2; i < CommandTokens.size(); i++) + for (SIZE_T i = 2; i < CommandTokens.size(); i++) { if (CompareLowerCaseStrings(CommandTokens.at(i), "psb")) PktPsb = TRUE; @@ -929,7 +1664,7 @@ CommandPt(vector CommandTokens, string Command) // // Parse and display disable options for !pt disable command // - CommandPtParseDisable(CommandTokens, &PtRequest); + CommandPtSendDisable(); } else if (CompareLowerCaseStrings(CommandTokens.at(1), "pause")) { @@ -943,7 +1678,7 @@ CommandPt(vector CommandTokens, string Command) // // Parse and display pause options for !pt pause command // - CommandPtParsePause(CommandTokens, &PtRequest); + CommandPtSendPause(); } else if (CompareLowerCaseStrings(CommandTokens.at(1), "resume")) { @@ -957,7 +1692,7 @@ CommandPt(vector CommandTokens, string Command) // // Parse and display resume options for !pt resume command // - CommandPtParseResume(CommandTokens, &PtRequest); + CommandPtSendResume(); } else if (CompareLowerCaseStrings(CommandTokens.at(1), "flush")) { @@ -971,7 +1706,7 @@ CommandPt(vector CommandTokens, string Command) // // Parse and display flush options for !pt flush command // - CommandPtParseFlush(CommandTokens, &PtRequest); + CommandPtSendFlush(); } else if (CompareLowerCaseStrings(CommandTokens.at(1), "dump")) { diff --git a/hyperdbg/libhyperdbg/header/libhyperdbg.h b/hyperdbg/libhyperdbg/header/app/libhyperdbg.h similarity index 100% rename from hyperdbg/libhyperdbg/header/libhyperdbg.h rename to hyperdbg/libhyperdbg/header/app/libhyperdbg.h diff --git a/hyperdbg/libhyperdbg/header/messaging.h b/hyperdbg/libhyperdbg/header/app/messaging.h similarity index 100% rename from hyperdbg/libhyperdbg/header/messaging.h rename to hyperdbg/libhyperdbg/header/app/messaging.h diff --git a/hyperdbg/libhyperdbg/header/packets.h b/hyperdbg/libhyperdbg/header/app/packets.h similarity index 100% rename from hyperdbg/libhyperdbg/header/packets.h rename to hyperdbg/libhyperdbg/header/app/packets.h diff --git a/hyperdbg/libhyperdbg/header/common.h b/hyperdbg/libhyperdbg/header/common/common.h similarity index 100% rename from hyperdbg/libhyperdbg/header/common.h rename to hyperdbg/libhyperdbg/header/common/common.h diff --git a/hyperdbg/libhyperdbg/header/list.h b/hyperdbg/libhyperdbg/header/common/list.h similarity index 100% rename from hyperdbg/libhyperdbg/header/list.h rename to hyperdbg/libhyperdbg/header/common/list.h diff --git a/hyperdbg/libhyperdbg/header/commands.h b/hyperdbg/libhyperdbg/header/debugger/commands/commands.h similarity index 100% rename from hyperdbg/libhyperdbg/header/commands.h rename to hyperdbg/libhyperdbg/header/debugger/commands/commands.h diff --git a/hyperdbg/libhyperdbg/header/help.h b/hyperdbg/libhyperdbg/header/debugger/commands/help.h similarity index 100% rename from hyperdbg/libhyperdbg/header/help.h rename to hyperdbg/libhyperdbg/header/debugger/commands/help.h diff --git a/hyperdbg/libhyperdbg/header/communication.h b/hyperdbg/libhyperdbg/header/debugger/communication/communication.h similarity index 100% rename from hyperdbg/libhyperdbg/header/communication.h rename to hyperdbg/libhyperdbg/header/debugger/communication/communication.h diff --git a/hyperdbg/libhyperdbg/header/forwarding.h b/hyperdbg/libhyperdbg/header/debugger/communication/forwarding.h similarity index 100% rename from hyperdbg/libhyperdbg/header/forwarding.h rename to hyperdbg/libhyperdbg/header/debugger/communication/forwarding.h diff --git a/hyperdbg/libhyperdbg/header/namedpipe.h b/hyperdbg/libhyperdbg/header/debugger/communication/namedpipe.h similarity index 100% rename from hyperdbg/libhyperdbg/header/namedpipe.h rename to hyperdbg/libhyperdbg/header/debugger/communication/namedpipe.h diff --git a/hyperdbg/libhyperdbg/header/debugger.h b/hyperdbg/libhyperdbg/header/debugger/core/debugger.h similarity index 100% rename from hyperdbg/libhyperdbg/header/debugger.h rename to hyperdbg/libhyperdbg/header/debugger/core/debugger.h diff --git a/hyperdbg/libhyperdbg/header/steppings.h b/hyperdbg/libhyperdbg/header/debugger/core/steppings.h similarity index 100% rename from hyperdbg/libhyperdbg/header/steppings.h rename to hyperdbg/libhyperdbg/header/debugger/core/steppings.h diff --git a/hyperdbg/libhyperdbg/header/install.h b/hyperdbg/libhyperdbg/header/debugger/driver-loader/install.h similarity index 100% rename from hyperdbg/libhyperdbg/header/install.h rename to hyperdbg/libhyperdbg/header/debugger/driver-loader/install.h diff --git a/hyperdbg/libhyperdbg/header/kd.h b/hyperdbg/libhyperdbg/header/debugger/kernel-level/kd.h similarity index 100% rename from hyperdbg/libhyperdbg/header/kd.h rename to hyperdbg/libhyperdbg/header/debugger/kernel-level/kd.h diff --git a/hyperdbg/libhyperdbg/header/assembler.h b/hyperdbg/libhyperdbg/header/debugger/misc/assembler.h similarity index 100% rename from hyperdbg/libhyperdbg/header/assembler.h rename to hyperdbg/libhyperdbg/header/debugger/misc/assembler.h diff --git a/hyperdbg/libhyperdbg/header/inipp.h b/hyperdbg/libhyperdbg/header/debugger/misc/inipp.h similarity index 100% rename from hyperdbg/libhyperdbg/header/inipp.h rename to hyperdbg/libhyperdbg/header/debugger/misc/inipp.h diff --git a/hyperdbg/libhyperdbg/header/pci-id.h b/hyperdbg/libhyperdbg/header/debugger/misc/pci-id.h similarity index 100% rename from hyperdbg/libhyperdbg/header/pci-id.h rename to hyperdbg/libhyperdbg/header/debugger/misc/pci-id.h diff --git a/hyperdbg/libhyperdbg/header/script-engine.h b/hyperdbg/libhyperdbg/header/debugger/script-engine/script-engine.h similarity index 100% rename from hyperdbg/libhyperdbg/header/script-engine.h rename to hyperdbg/libhyperdbg/header/debugger/script-engine/script-engine.h diff --git a/hyperdbg/libhyperdbg/header/symbol.h b/hyperdbg/libhyperdbg/header/debugger/script-engine/symbol.h similarity index 90% rename from hyperdbg/libhyperdbg/header/symbol.h rename to hyperdbg/libhyperdbg/header/debugger/script-engine/symbol.h index ab6a177d..d516018f 100644 --- a/hyperdbg/libhyperdbg/header/symbol.h +++ b/hyperdbg/libhyperdbg/header/debugger/script-engine/symbol.h @@ -26,6 +26,18 @@ typedef struct _LOCAL_FUNCTION_DESCRIPTION } LOCAL_FUNCTION_DESCRIPTION, *PLOCAL_FUNCTION_DESCRIPTION; +/** + * @brief Save the local module symbols' description + * + */ +typedef struct _IMAGE_SYMBOL_CONTEXT +{ + UINT64 ImageBase; + UINT64 CodeBase; + UINT64 CodeSize; + UINT8 * Code; +} IMAGE_SYMBOL_CONTEXT; + ////////////////////////////////////////////////// // Pdbex // ////////////////////////////////////////////////// diff --git a/hyperdbg/libhyperdbg/header/tests.h b/hyperdbg/libhyperdbg/header/debugger/tests/tests.h similarity index 100% rename from hyperdbg/libhyperdbg/header/tests.h rename to hyperdbg/libhyperdbg/header/debugger/tests/tests.h diff --git a/hyperdbg/libhyperdbg/header/transparency.h b/hyperdbg/libhyperdbg/header/debugger/transparency/transparency.h similarity index 100% rename from hyperdbg/libhyperdbg/header/transparency.h rename to hyperdbg/libhyperdbg/header/debugger/transparency/transparency.h diff --git a/hyperdbg/libhyperdbg/header/pe-parser.h b/hyperdbg/libhyperdbg/header/debugger/user-level/pe-parser.h similarity index 100% rename from hyperdbg/libhyperdbg/header/pe-parser.h rename to hyperdbg/libhyperdbg/header/debugger/user-level/pe-parser.h diff --git a/hyperdbg/libhyperdbg/header/ud.h b/hyperdbg/libhyperdbg/header/debugger/user-level/ud.h similarity index 100% rename from hyperdbg/libhyperdbg/header/ud.h rename to hyperdbg/libhyperdbg/header/debugger/user-level/ud.h diff --git a/hyperdbg/libhyperdbg/header/export.h b/hyperdbg/libhyperdbg/header/export/export.h similarity index 100% rename from hyperdbg/libhyperdbg/header/export.h rename to hyperdbg/libhyperdbg/header/export/export.h diff --git a/hyperdbg/libhyperdbg/header/globals.h b/hyperdbg/libhyperdbg/header/globals/globals.h similarity index 100% rename from hyperdbg/libhyperdbg/header/globals.h rename to hyperdbg/libhyperdbg/header/globals/globals.h diff --git a/hyperdbg/libhyperdbg/header/hwdbg-interpreter.h b/hyperdbg/libhyperdbg/header/hwdbg/hwdbg-interpreter.h similarity index 100% rename from hyperdbg/libhyperdbg/header/hwdbg-interpreter.h rename to hyperdbg/libhyperdbg/header/hwdbg/hwdbg-interpreter.h diff --git a/hyperdbg/libhyperdbg/header/hwdbg-scripts.h b/hyperdbg/libhyperdbg/header/hwdbg/hwdbg-scripts.h similarity index 100% rename from hyperdbg/libhyperdbg/header/hwdbg-scripts.h rename to hyperdbg/libhyperdbg/header/hwdbg/hwdbg-scripts.h diff --git a/hyperdbg/libhyperdbg/header/objects.h b/hyperdbg/libhyperdbg/header/objects/objects.h similarity index 100% rename from hyperdbg/libhyperdbg/header/objects.h rename to hyperdbg/libhyperdbg/header/objects/objects.h diff --git a/hyperdbg/libhyperdbg/header/rev-ctrl.h b/hyperdbg/libhyperdbg/header/rev/rev-ctrl.h similarity index 100% rename from hyperdbg/libhyperdbg/header/rev-ctrl.h rename to hyperdbg/libhyperdbg/header/rev/rev-ctrl.h diff --git a/hyperdbg/libhyperdbg/libhyperdbg.vcxproj b/hyperdbg/libhyperdbg/libhyperdbg.vcxproj index c5a8ad58..c943b6e8 100644 --- a/hyperdbg/libhyperdbg/libhyperdbg.vcxproj +++ b/hyperdbg/libhyperdbg/libhyperdbg.vcxproj @@ -78,7 +78,7 @@ Windows true false - $(SolutionDir)libraries\zydis\user\Zycore.lib;$(SolutionDir)libraries\zydis\user\Zydis.lib;$(SolutionDir)build\bin\$(Configuration)\script-engine.lib;$(SolutionDir)libraries\keystone\$(Configuration)-lib\keystone.lib;%(AdditionalDependencies) + $(SolutionDir)libraries\zydis\user\Zycore.lib;$(SolutionDir)libraries\zydis\user\Zydis.lib;$(SolutionDir)build\bin\$(Configuration)\script-engine.lib;$(SolutionDir)libraries\keystone\$(Configuration)-lib\keystone.lib;$(SolutionDir)libraries\libipt\libipt.lib;%(AdditionalDependencies) %(AdditionalLibraryDirectories) false @@ -116,7 +116,7 @@ msbuild "$(SolutionDir)dependencies\zydis\msvc\Zydis.sln" /m /p:Configuration="R true true false - $(SolutionDir)libraries\zydis\user\Zycore.lib;$(SolutionDir)libraries\zydis\user\Zydis.lib;$(SolutionDir)build\bin\$(Configuration)\script-engine.lib;$(SolutionDir)libraries\keystone\$(Configuration)-lib\keystone.lib;%(AdditionalDependencies) + $(SolutionDir)libraries\zydis\user\Zycore.lib;$(SolutionDir)libraries\zydis\user\Zydis.lib;$(SolutionDir)build\bin\$(Configuration)\script-engine.lib;$(SolutionDir)libraries\keystone\$(Configuration)-lib\keystone.lib;$(SolutionDir)libraries\libipt\libipt.lib;%(AdditionalDependencies) %(AdditionalLibraryDirectories) true @@ -140,35 +140,35 @@ msbuild "$(SolutionDir)dependencies\zydis\msvc\Zydis.sln" /m /p:Configuration="R - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/hyperdbg/libhyperdbg/libhyperdbg.vcxproj.filters b/hyperdbg/libhyperdbg/libhyperdbg.vcxproj.filters index 9b62836e..236c3074 100644 --- a/hyperdbg/libhyperdbg/libhyperdbg.vcxproj.filters +++ b/hyperdbg/libhyperdbg/libhyperdbg.vcxproj.filters @@ -102,95 +102,68 @@ {da7e68cc-540c-4efc-b4de-c23b4b13e2ec} + + {d6010267-4888-46f5-9bdb-2339565710d2} + + + {e81c07d3-5e98-4bdb-a00b-2b99e023553c} + + + {477d3059-08d7-433b-83c3-bbf57658deaf} + + + {559b68f3-8bf0-447a-a714-0e355c22516f} + + + {88de3dbf-90ab-47ef-94fe-8c21ce73c9f1} + + + {c1f438ff-fd3b-4fb4-989b-f145290e3837} + + + {c5b26259-abcc-459f-9b7e-fd90c34ad646} + + + {99425a01-168c-4b6b-a53f-d62fbb7c8cab} + + + {c7f85132-1802-4462-990f-3fffb0365dbc} + + + {4f4eca9f-c1f6-4342-91ef-2b533292e238} + + + {bde7408e-fad9-4329-98ac-e604674f7bbf} + + + {06e9888f-57f0-4d59-8f7e-1fdd336be9cc} + + + {0d88d581-8ff4-40f2-8585-3fdb97d4d211} + + + {439dcb49-1825-4076-affe-17b505e4033a} + + + {16331b3c-c8fd-4b12-abb4-7617d21db9d0} + + + {2d2c16a6-3fdc-4b63-a282-f2762a1f340d} + + + {9dcff6b3-9ebd-46f3-a0c5-c69d06357949} + + + {3e4dda9f-6050-409f-85e2-4cf7c8a95743} + header - - header - - - header - - - header - - - header - - - header - - - header - - - header - - - header - - - header - - - header - - - header - - - header - - - header - - - header - - - header - - - header - - - header - - - header - - - header - - - header - - - header - header\platform - - header - - - header - - - header - - - header - - - header - - - header - header\platform @@ -209,18 +182,99 @@ header\platform - - header - - - header - header\platform\windows-only header\components\pe + + header\app + + + header\app + + + header\app + + + header\common + + + header\common + + + header\export + + + header\globals + + + header\hwdbg + + + header\hwdbg + + + header\rev + + + header\objects + + + header\debugger\commands + + + header\debugger\commands + + + header\debugger\communication + + + header\debugger\communication + + + header\debugger\communication + + + header\debugger\core + + + header\debugger\core + + + header\debugger\driver-loader + + + header\debugger\kernel-level + + + header\debugger\misc + + + header\debugger\misc + + + header\debugger\misc + + + header\debugger\user-level + + + header\debugger\user-level + + + header\debugger\transparency + + + header\debugger\tests + + + header\debugger\script-engine + + + header\debugger\script-engine + diff --git a/hyperdbg/libhyperdbg/pch.cpp b/hyperdbg/libhyperdbg/pch.cpp index 92958c22..fa15fce4 100644 --- a/hyperdbg/libhyperdbg/pch.cpp +++ b/hyperdbg/libhyperdbg/pch.cpp @@ -14,7 +14,7 @@ // // Global variables // -#include "header/globals.h" +#include "header/globals/globals.h" // // When you are using pre-compiled headers, this source file is necessary for diff --git a/hyperdbg/libhyperdbg/pch.h b/hyperdbg/libhyperdbg/pch.h index f06ccdf7..96640e8c 100644 --- a/hyperdbg/libhyperdbg/pch.h +++ b/hyperdbg/libhyperdbg/pch.h @@ -41,30 +41,29 @@ typedef RFLAGS * PRFLAGS; #define USE_NATIVE_SDK_HEADERS #define _AMD64_ - #ifdef _WIN32 -#if defined(USE__NATIVE_PHNT_HEADERS) +# if defined(USE__NATIVE_PHNT_HEADERS) // // Dirty fix: the "PCWCHAR" in undefined in "ntrtl.h" so I deifined it here. // typedef const wchar_t *LPCWCHAR, *PCWCHAR; -# define PHNT_MODE PHNT_MODE_USER -# define PHNT_VERSION PHNT_WIN11 // Windows 11 -# define PHNT_PATCH_FOR_HYPERDBG TRUE +# define PHNT_MODE PHNT_MODE_USER +# define PHNT_VERSION PHNT_WIN11 // Windows 11 +# define PHNT_PATCH_FOR_HYPERDBG TRUE -# include -# include +# include +# include -#elif defined(USE_NATIVE_SDK_HEADERS) +# elif defined(USE_NATIVE_SDK_HEADERS) -# include -# include -# include -# include +# include +# include +# include +# include -#endif +# endif #endif //_WIN32 @@ -108,6 +107,7 @@ typedef const wchar_t *LPCWCHAR, *PCWCHAR; #include #include #include +#include // // Scope definitions @@ -187,50 +187,60 @@ typedef const wchar_t *LPCWCHAR, *PCWCHAR; // // PCI IDs // -#include "header/pci-id.h" +#include "header/debugger/misc/pci-id.h" + +// +// Intel PT +// +#include "../dependencies/libipt/intel-pt.h" // // General // -#include "header/libhyperdbg.h" -#include "header/export.h" -#include "header/inipp.h" -#include "header/commands.h" -#include "header/common.h" -#include "header/symbol.h" -#include "header/debugger.h" -#include "header/script-engine.h" -#include "header/help.h" +#include "header/app/libhyperdbg.h" +#include "header/export/export.h" +#include "header/debugger/misc/inipp.h" +#include "header/debugger/commands/commands.h" +#include "header/common/common.h" +#include "header/debugger/script-engine/symbol.h" +#include "header/debugger/core/debugger.h" +#include "header/debugger/script-engine/script-engine.h" +#include "header/debugger/commands/help.h" #ifdef _WIN32 -# include "header/install.h" +# include "header/debugger/driver-loader/install.h" #endif -#include "header/list.h" -#include "header/tests.h" -#include "header/messaging.h" -#include "header/packets.h" -#include "header/transparency.h" -#include "header/communication.h" -#include "header/namedpipe.h" -#include "header/forwarding.h" -#include "header/kd.h" +#include "header/common/list.h" +#include "header/debugger/tests/tests.h" +#include "header/app/messaging.h" +#include "header/app/packets.h" +#include "header/debugger/transparency/transparency.h" +#include "header/debugger/communication/communication.h" +#include "header/debugger/communication/namedpipe.h" +#include "header/debugger/communication/forwarding.h" +#include "header/debugger/kernel-level/kd.h" // // Components // #include "../include/components/pe/header/pe-image-reader.h" -#include "header/pe-parser.h" -#include "header/ud.h" -#include "header/objects.h" -#include "header/steppings.h" -#include "header/rev-ctrl.h" -#include "header/assembler.h" +#include "header/debugger/user-level/pe-parser.h" +#include "header/debugger/user-level/ud.h" +#include "header/objects/objects.h" +#include "header/debugger/core/steppings.h" +#include "header/rev/rev-ctrl.h" +#include "header/debugger/misc/assembler.h" // // hwdbg // -#include "header/hwdbg-interpreter.h" -#include "header/hwdbg-scripts.h" +#include "header/hwdbg/hwdbg-interpreter.h" +#include "header/hwdbg/hwdbg-scripts.h" + +// +// Zydis headers +// +#include // // Libraries @@ -261,4 +271,9 @@ typedef const wchar_t *LPCWCHAR, *PCWCHAR; # pragma comment(lib, "Psapi.lib") # pragma comment(lib, "Kernel32.lib") +// +// For resolving symbols on Intel PT +// +# pragma comment(lib, "dbghelp.lib") + #endif // HYPERDBG_ENV_WINDOWS